CVE-2026-93751 in uri-js
Summary
by MITRE • 09/18/2026
uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequences that downstream consumers process without filtering.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/18/2026
The uri-js library, specifically versions through 4.4.1, contains a critical improper input decoding vulnerability within its pctDecChars function. This flaw stems from an insufficient validation of percent-encoded URI components during the parsing phase. The core technical issue lies in how the parser handles sequences that are either invalid according to RFC 3986 standards or represent overlong encodings of ASCII characters. Instead of rejecting these malformed inputs, the library incorrectly decodes them into their corresponding ASCII metacharacters. This behavior deviates from strict URI parsing norms and creates a discrepancy between what is encoded in the input string and how it is interpreted by downstream components that rely on uri-js for normalization or validation.
This vulnerability allows attackers to craft malicious percent-encoded payloads designed specifically to bypass platform-level decoder validations. Many web frameworks and security gateways perform initial decoding of URIs before passing them to application logic, often assuming that subsequent layers will handle any remaining special characters appropriately. By exploiting the improper UTF-8 handling in uri-js, an attacker can encode path traversal sequences or Carriage Return Line Feed (CRLF) characters in a way that evades these preliminary checks. The library then decodes these into raw ASCII metacharacters, effectively neutralizing the protective barriers intended to filter out dangerous input patterns before they reach critical application endpoints.
The operational impact of this flaw is significant for applications relying on uri-js for URI manipulation and validation. In path traversal scenarios, an attacker can inject sequences such as dot-dot-slash encoded in a manner that bypasses standard sanitization routines, potentially leading to unauthorized access to sensitive files or directories within the server file system. This aligns with CWE-20 Improper Input Validation and CWE-73 External Control of File Name or Path. In CRLF injection cases, the ability to inject newline characters into HTTP headers can lead to response splitting attacks. These attacks enable attackers to modify HTTP responses, potentially facilitating cross-site scripting (XSS), session hijacking, or cache poisoning. This aspect maps directly to CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers and is associated with MITRE ATT&CK technique T1071 Application Layer Protocol: Web Protocols for command and control or data exfiltration via manipulated responses.
Mitigation strategies must focus on immediate updates and defensive coding practices. The primary remediation step is to upgrade the uri-js dependency to version 4.4.2 or later, where this decoding logic has been corrected to strictly adhere to URI standards and reject invalid percent-encoded sequences rather than misinterpreting them. For applications unable to update immediately due to compatibility constraints, developers should implement additional input validation layers that enforce strict RFC 3986 compliance before passing URIs to the library. This includes manually verifying that all percent-encoded characters represent valid UTF-8 or ASCII bytes and rejecting any overlong encodings explicitly. Furthermore, integrating a Web Application Firewall (WAF) with rules specifically tuned for detecting obfuscated path traversal and CRLF injection attempts can provide an additional layer of defense against exploitation while the underlying library is being patched.